2017 CVEs (page 13)
Page 13 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-3143 | High | 7.5 | 2019-01-16 | An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service bei… |
CVE-2017-3142 | Medium | 5.3 | 2019-01-16 | An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TS… |
CVE-2017-3141 | High | 7.2 | 2019-01-16 | The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions a… |
CVE-2017-3140 | Low | 3.7 | 2019-01-16 | If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while hand… |
CVE-2017-3138 | Medium | 6.5 | 2019-01-16 | named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a… |
CVE-2017-3137 | High | 7.5 | 2019-01-16 | Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in… |
CVE-2017-3136 | Medium | 5.9 | 2019-01-16 | A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately… |
CVE-2017-3135 | High | 7.5 | 2019-01-16 | Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIS… |
CVE-2017-6921 | Medium | 5.9 | 2019-01-15 | In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site… |
CVE-2017-6924 | High | 7.4 | 2019-01-15 | In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does no… |
CVE-2017-6925 | Critical | 9.8 | 2019-01-15 | In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or… |
CVE-2017-18358 | Medium | 6.1 | 2019-01-15 | LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address, which is mishandled in the admin pane… |
CVE-2017-18357 | Medium | 6.5 | 2019-01-15 | Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_Product… |
CVE-2017-18356 | High | 8.8 | 2019-01-15 | In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at… |
CVE-2017-2411 | Medium | 5.9 | 2019-01-11 | In iOS before 11.2, exchange rates were retrieved from HTTP rather than HTTPS. This was addressed by enabling HTTPS for exchange rates. |
CVE-2017-13891 | Medium | 6.5 | 2019-01-11 | In iOS before 11.2, an inconsistent user interface issue was addressed through improved state management. |
CVE-2017-13889 | Critical | 9.8 | 2019-01-11 | In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a logic error existed in the validation of crede… |
CVE-2017-13888 | High | 7.5 | 2019-01-11 | In iOS before 11.2, a type confusion issue was addressed with improved memory handling. |
CVE-2017-13887 | High | 7.5 | 2019-01-11 | In macOS High Sierra before 10.13.2, a logic issue existed in APFS when deleting keys during hibernation. This was addressed with improved state management. |
CVE-2017-13886 | Medium | 6.5 | 2019-01-11 | In macOS High Sierra before 10.13.2, an access issue existed with privileged WiFi system configuration. This issue was addressed with additional restrictions. |
CVE-2017-1002157 | Critical | 9.8 | 2019-01-10 | modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. |
CVE-2017-1002152 | Medium | 6.1 | 2019-01-10 | Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles. |
CVE-2017-3718 | Medium | 6.2 | 2019-01-10 | Improper setting of device configuration in system firmware for Intel(R) NUC kits may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2017-15428 | High | 8.8 | 2019-01-09 | Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and… |
CVE-2017-15405 | High | 7.0 | 2019-01-09 | Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established by a malicious code… |
CVE-2017-15404 | High | 7.8 | 2019-01-09 | An ability to process crash dumps under root privileges and inappropriate symlinks handling could lead to a local privilege escalation in Crash Reporting in Go… |
CVE-2017-15403 | High | 7.3 | 2019-01-09 | Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163… |
CVE-2017-15402 | Critical | 9.6 | 2019-01-09 | Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the same process in Navig… |
CVE-2017-15401 | High | 8.8 | 2019-01-09 | A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3202.62 allowed a re… |
CVE-2017-18330 | High | 7.8 | 2019-01-03 | Buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in snapdragon automobile, snapdragon mobile and snapdragon wear in versions IPQ8074… |
CVE-2017-18329 | High | 7.8 | 2019-01-03 | Possible Buffer overflow when transmitting an RTP packet in snapdragon automobile and snapdragon wear in versions MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645… |
CVE-2017-18328 | High | 7.8 | 2019-01-03 | Use after free in QSH client rule processing in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM965… |
CVE-2017-18327 | Medium | 5.5 | 2019-01-03 | Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607… |
CVE-2017-18326 | Medium | 5.5 | 2019-01-03 | Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in versions MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM96… |
CVE-2017-18324 | Medium | 5.5 | 2019-01-03 | Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M… |
CVE-2017-18323 | Medium | 5.5 | 2019-01-03 | Cryptographic key material leaked in TDSCDMA RRC debug messages in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, M… |
CVE-2017-18322 | Medium | 5.5 | 2019-01-03 | Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MD… |
CVE-2017-18321 | Medium | 5.5 | 2019-01-03 | Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660. |
CVE-2017-18320 | High | 7.8 | 2019-01-03 | QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdragon automobile and snapdragon mobile in versions MSM8996AU… |
CVE-2017-18319 | Medium | 5.5 | 2019-01-03 | Information leak in UIM API debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9645, MDM9650… |
CVE-2017-18141 | High | 7.8 | 2019-01-03 | When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to privileged functions… |
CVE-2017-11004 | Medium | 5.5 | 2019-01-03 | A non-secure user may be able to access certain registers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions IPQ8074, MDM9206, MDM9607… |
CVE-2017-9732 | High | 7.5 | 2018-12-20 | The read_packet function in knc (Kerberised NetCat) before 1.11-1 is vulnerable to denial of service (memory exhaustion) that can be exploited remotely without… |
CVE-2017-9704 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, There is no synchronization between msm_vb2 buffer o… |
CVE-2017-15031 | High | 7.5 | 2018-12-18 | In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing infor… |
CVE-2017-1597 | Medium | 5.9 | 2018-12-17 | IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords b… |
CVE-2017-1272 | Low | 3.7 | 2018-12-17 | IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access… |
CVE-2017-1265 | Low | 3.7 | 2018-12-17 | IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate. This weakness might allo… |
CVE-2017-18355 | High | 7.5 | 2018-12-17 | Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" at… |
CVE-2017-18354 | High | 7.5 | 2018-12-17 | Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote… |
CVE-2017-18353 | High | 7.5 | 2018-12-17 | Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GE… |
CVE-2017-18352 | Medium | 6.1 | 2018-12-17 | Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs. |
CVE-2017-1268 | Medium | 5.9 | 2018-12-13 | IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does n… |
CVE-2017-16910 | Medium | 6.5 | 2018-12-07 | An error within the "LibRaw::xtrans_interpolate()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause an invalid… |
CVE-2017-16909 | High | 8.8 | 2018-12-07 | An error related to the "LibRaw::panasonic_load_raw()" function (dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause a heap-based bu… |
CVE-2017-15835 | Medium | 6.5 | 2018-12-07 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, While processing the RIC Data Descriptor IE in an ar… |
CVE-2017-14888 | High | 7.8 | 2018-12-07 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Userspace can pass IEs to the host driver and if mul… |
CVE-2017-1622 | Low | 3.7 | 2018-12-05 | IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrectly validates, a certificate. This weakness might allow an attacker to spoof a trusted entity by us… |
CVE-2017-18318 | Critical | 9.8 | 2018-11-28 | Missing validation check on CRL issuer name in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU, SD 410/12, SD 425, SD 430, SD 450, SD 625, SD 65… |
CVE-2017-18317 | High | 7.8 | 2018-11-28 | Restrictions related to the modem (sim lock, sim kill) can be bypassed by manipulating the system to issue a deactivation flow sequence in Snapdragon Automobil… |
CVE-2017-18316 | High | 7.8 | 2018-11-28 | Secure application can access QSEE kernel memory through Ontario kernel driver in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9… |
CVE-2017-18315 | High | 7.8 | 2018-11-28 | Buffer over-read vulnerabilities in an older version of ASN.1 parser in Snapdragon Mobile in versions SD 600. |
CVE-2017-11078 | High | 7.8 | 2018-11-27 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the boot image header, an out of bo… |
CVE-2017-1418 | Medium | 4.0 | 2018-11-26 | IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure permissions on certain… |
CVE-2017-17550 | High | 8.8 | 2018-11-10 | ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's… |
CVE-2017-1119 | Medium | 4.3 | 2018-11-09 | IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted reque… |
CVE-2017-1609 | Medium | 5.4 | 2018-11-02 | IBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja… |
CVE-2017-8931 | Critical | 9.8 | 2018-10-30 | Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via unspecified vectors. |
CVE-2017-18281 | Medium | 5.5 | 2018-10-29 | A bool variable in Video function, which gets typecasted to int before being read could result in an out of bound read access in all Android releases from CAF… |
CVE-2017-18311 | High | 7.8 | 2018-10-26 | XPU Master privilege escalation is possible due to improper access control of unused configuration xPU ports where unused configuration ports are open in Snapd… |
CVE-2017-18310 | High | 7.8 | 2018-10-26 | ClientEnv exposes services 0-32 to HLOS in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 4… |
CVE-2017-18309 | High | 7.1 | 2018-10-26 | A micro-core of QMP transportation may cause a macro-core to read from or write to arbitrary memory in Snapdragon Mobile in version SD 845, SD 850. |
CVE-2017-18308 | High | 7.8 | 2018-10-26 | Modem segments are unlocked after authentication, leaving modem segments open to all in Snapdragon Mobile, Snapdragon Wear in version MDM9607, MSM8909W, SD 210… |
CVE-2017-18124 | High | 7.8 | 2018-10-26 | During secure boot, addition is performed on uint8 ptrs which led to overflow issue in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wea… |
CVE-2017-18349 | Critical | 9.8 | 2018-10-23 | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a cr… |
CVE-2017-18313 | Medium | 5.3 | 2018-10-23 | Under certain mode of operations, HLOS may be able get direct or indirect access through DXE channels to tamper with the authenticated WCNSS firmware stored in… |
CVE-2017-18312 | High | 7.8 | 2018-10-23 | While accessing SafeSwitch services, third party can manipulate a given device and perform unauthorized operation due to lack of checking of same state transit… |
CVE-2017-18305 | High | 7.0 | 2018-10-23 | XBL sec mem dump system call allows complete control of EL3 by unlocking all XPUs if enable fuse is not blown in Snapdragon Mobile, Snapdragon Wear in version… |
CVE-2017-18304 | High | 7.8 | 2018-10-23 | Insufficient memory allocation in boot due to incorrect size being passed could result in out of bounds access in Small Cell SoC, Snapdragon Automobile, Snapdr… |
CVE-2017-18303 | High | 7.8 | 2018-10-23 | While processing the sensors registry configuration file, if inputs are not validated a buffer overflow will occur in Snapdragon Automobile, Snapdragon Mobile… |
CVE-2017-18300 | Medium | 5.5 | 2018-10-23 | Secure display content could be accessed by third party trusted application after creating a fault in other trusted applications in Snapdragon Mobile, Snapdrag… |
CVE-2017-18299 | Medium | 5.5 | 2018-10-23 | Improper translation table consolidation logic leads to resource exhaustion and QSEE error in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in v… |
CVE-2017-18298 | High | 7.8 | 2018-10-23 | Lack of Input Validation in SDMX API can lead to NULL pointer access in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM96… |
CVE-2017-18297 | High | 7.8 | 2018-10-23 | Double memory free while closing TEE SE API Session management in Snapdragon Mobile in version SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820. |
CVE-2017-18296 | High | 7.8 | 2018-10-23 | Access control on applications is not applied while accessing SafeSwitch services can lead to improper access in Snapdragon Automobile, Snapdragon Mobile, Snap… |
CVE-2017-18295 | High | 7.8 | 2018-10-23 | Possible buffer overflow if input is not null terminated in DSP Service module in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206… |
CVE-2017-18294 | High | 7.8 | 2018-10-23 | While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size in Small Cell SoC… |
CVE-2017-18293 | High | 7.8 | 2018-10-23 | When a particular GPIO is protected by blocking access to the corresponding GPIO resource registers, the protection can be bypassed using the corresponding ban… |
CVE-2017-18292 | Medium | 5.5 | 2018-10-23 | Secure app running in non secure space can restart TZ by calling Widevine app API repeatedly in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in… |
CVE-2017-18283 | Medium | 6.5 | 2018-10-23 | Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 625, SD… |
CVE-2017-18282 | High | 7.8 | 2018-10-23 | Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MD… |
CVE-2017-18277 | Medium | 5.5 | 2018-10-23 | When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop without retrying for memory allocation in Sn… |
CVE-2017-18172 | High | 7.8 | 2018-10-23 | In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buffer size resulting in an Integer Overflow or Wraparound in… |
CVE-2017-18171 | High | 8.8 | 2018-10-23 | Improper input validation for GATT data packet received in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version… |
CVE-2017-18170 | High | 8.8 | 2018-10-23 | Improper input validation in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205… |
CVE-2017-18348 | High | 7.0 | 2018-10-19 | Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging… |
CVE-2017-17176 | Medium | 6.7 | 2018-10-17 | The hardware security module of Mate 9 and Mate 9 Pro Huawei smart phones with the versions earlier before MHA-AL00BC00B156, versions earlier before MHA-CL00BC… |
CVE-2017-5934 | Medium | 6.1 | 2018-10-15 | Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or… |
CVE-2017-1231 | Medium | 4.4 | 2018-10-12 | IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910. |
CVE-2017-5658 | Medium | 5.3 | 2018-10-04 | The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derive… |